Security and data

1. What we read

We read workflow definitions, property definitions, and the names of lists, forms, marketing emails, sequences, teams, pipeline stages and custom object types. We also read the names and email addresses of the HubSpot users in the portal, to show who created or edited a workflow.

Access is read-only OAuth, with 19 scopes, listed in the table below.

HubSpot offers no read-only version of the automation, forms and content scopes, so they technically allow writing. Untanggy never writes to a connected portal: the only non-read calls it makes are the OAuth token exchange, refresh, introspection and revocation on disconnect.

We never read contact, company, deal or ticket records. The only record-level event we receive is HubSpot’s contact deletion webhook, which carries a contact id; we acknowledge and log it.

The crm.objects.contacts.read scope is required by HubSpot to subscribe to that webhook. We make no other use of it and store no contact record.

2. Where data is processed and stored

• Database: Supabase (PostgreSQL), AWS eu-west-1, Ireland.
• Application functions: Vercel, region dub1, Dublin, Ireland.
• Job orchestration: Inngest, United States (SOC 2 Type II). Inngest runs our sync jobs and stores their execution state for 24 hours. Today that state includes portal configuration metadata (workflow, property, list and team names, and the names and email addresses of HubSpot users). We are changing our sync jobs so that Inngest only handles identifiers and no personal data; this page will be updated when that ships. Until then, no data processing agreement covers this transfer.

3. Encryption

HubSpot tokens are encrypted at rest (AES-256). All traffic uses TLS. The database is encrypted at rest by Supabase.

4. Deletion

Disconnecting a portal revokes our HubSpot token and deletes all synced data for that portal immediately, with a timestamped log entry (who, when, revocation result). Revoking our access does not uninstall the app from HubSpot; a HubSpot admin can do that in Connected Apps.

Deleting an account does the same for every portal, then deletes the account.

We do not keep database backups beyond the live database. Data held by sub-processors after deletion (billing records at Stripe, delivered emails at Resend, application logs at Vercel and Supabase, sync state at Inngest for 24 hours) expires under each provider’s retention period.

5. Retention

Portal data is kept only while the portal is connected. We keep sync timestamps per organisation for rate limiting; they contain no portal content.

Application logs may contain the sign-in email of an Untanggy user and the name of a connected portal; we are removing these from logs.

6. Access

Untanggy is operated by a single founder (HS Simple SASU). No third party has human access to customer data.

All administrative accounts are protected by multi-factor authentication.

7. Incidents

Affected customers are notified without undue delay and within 72 hours of our becoming aware of a personal data breach.

Security contact: hello@untanggy.com.

8. Sub-processors

We give 30 days’ notice before adding a sub-processor. Customers can object at hello@untanggy.com.

9. Data Processing Agreement

Read our Data Processing Agreement.

Last updated: 24 September 2026